formbook | 2196-13-0x0000000000400000-0x000000000042F000-memory[.]dmp

Sharing

Copy URL Twitter E-mail

General

Target
2196-13-0x0000000000400000-0x000000000042F000-memory.dmp
Size 188KB
Sample240518-bqa27adc8x
SHA256 ce97b83a3cd52f6199f5011970980fef73d40abe11428f97f16a6a93abc58893
MD5 1798b3d43a4759f1600761166ffbace1
SHA1 04a6bc264e910b055fbec38142040869a6701168
SHA512 b27e8fc88f8eb3801d23a5712949b9c58ee1b54634cb33031e0970bd6f3ba93791151ecbc40f4c916ea4b70c14ef27a566c509bdbe7875ae2b4918e65370f18f
SSDEEP 3072:JncbkDcxkrWi4c3EyeofZ8CHHKaJOC1/MU78EA9tU2nwhS0B9:zoizExCxKaJOCvRCt1wrB9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat pz12 formbook

Malware Config

Extracted

Family

formbook

Version

Campaign

pz12

Decoy

paucanyes.com
autonwheels.com
cowboysandcaviarbar.com
fitnessengineeredworkouts.com
nuevobajonfavorito.com
dflx8.com
rothability.com
sxybet88.com
onesource.live
brenjitu1904.com
airdrop-zero1labs.com
guangdongqiangzhetc.com
apartments-for-rent-72254.bond
ombak99.lol
qqfoodsolutions.com
kyyzz.com
thepicklematch.com
ainth.com
missorris.com
gabbygomez.com
aromacuppa.com
kaskusbagus.com
zoox1.asia
hemophilia-treatment-41433.bond
meidupro.com
shrisona.com
sekanse.com
marcocostasax.com
loyalbahis356.com
mzmz97.com
ma-google.com
xiangadvanced.site
tuotalogis.com
xcxocef.shop
fidgetbottles.com
shuaninvolved.site
ambientelatino.com
98980901.com
singhbrothersframes.com
pureamyl.com
hgs0713.net
surejobzapp.com
slotgame99.bet
datalakeflow.com
ebehemin.com
vanessasmobilespa.com
317wb.com
motchillssss.top
huesch.net
salesgymshark.shop
mejorcompra99.com
tacubashop.com
jessicaxsimmons.com
roar-stores.com
chalkandthimble.com
84556.vip
luyutuwen.com
siliconcollege.icu
marvowhite.com
gjxuh82y0u3h6.top
e2taop5.top
businessbroadway.com
cripmz.xyz
4hu259.com
jnhdh8827.com

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2196-13-0x0000000000400000-0x000000000042F000-memory.dmp

File Explorer

2196-13-0x0000000000400000-0x000000000042F000-memory.dmp

.exe 188KB

2196-13-0x0000000000400000-0x000000000042F000-memory.dmp

SHA256 ce97b83a3cd52f6199f5011970980fef73d40abe11428f97f16a6a93abc58893
MD5 1798b3d43a4759f1600761166ffbace1
SHA1 04a6bc264e910b055fbec38142040869a6701168
SHA512 b27e8fc88f8eb3801d23a5712949b9c58ee1b54634cb33031e0970bd6f3ba93791151ecbc40f4c916ea4b70c14ef27a566c509bdbe7875ae2b4918e65370f18f
SSDEEP 3072:JncbkDcxkrWi4c3EyeofZ8CHHKaJOC1/MU78EA9tU2nwhS0B9:zoizExCxKaJOCvRCt1wrB9
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Formbook payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

127264

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths